创建 IAM 角色并为其附加策略时出错

Question

我正在尝试创建一个 lambda 角色并为其附加策略，以便它可以启动和停止 ec2 实例。我将使用 cloudwatch 触发 lambda。

我收到此错误： “错误：创建 IAM 角色 lambdaRole 时出错：MalformedPolicyDocument：JSON 字符串不能有前导空格状态代码：400，请求 ID：d6a86c41-6601-43af-9040-81f6e6a76ec8

在 iam.tf 第 11 行，在资源 "aws_iam_role" "lambdaRole" 中： 11: 资源 "aws_iam_role" "lambdaRole" {"

 terraform {
    backend  "s3" {
    region         = "us-west-2"
    bucket         = "gitlegionbucket"
    key            = "ec2/terraform.tfstate"
    dynamodb_table = "tf-state-lock"
    }
}

resource "aws_iam_role" "lambdaRole" {
  name = "lambdaRole"

  assume_role_policy = <<EOF
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Principal": {
          "Service": "ec2.amazonaws.com"
          },
          "Effect": "Allow",
          "Sid": ""
        }
      ]
    }
EOF
}

resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Start*",
        "ec2:Stop*"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "attach-policies" {
  role       = "${aws_iam_role.lambdaRole.name}"
  policy_arn = "${aws_iam_policy.policy.arn}"
}

Answer 1

好的，我找到了解决这个问题的方法。我将 json 移到了不同的文件中，我只是引用了这些文件。

像这样，policy = "${file("lambda-policy.json")}"

我在 "lambda-policy.json" 中有这个： { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:StartInstances", "logs:", "ec2:StopInstances" ], "Resource": "" } ] }

Answer 2

我也遇到了同样的错误。我已经直接从问题中复制了代码。

它的工作方式对我来说是启动 { 即在 EOF 行之后立即开始策略，没有任何空格。

resource "aws_iam_role" "lambdaRole" {
  name = "lambdaRole"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Action": "sts:AssumeRole",
        "Principal": {
        "Service": "ec2.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
    }
    ]
}
EOF
}

resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Start*",
        "ec2:Stop*"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "attach-policies" {
  role       = "${aws_iam_role.lambdaRole.name}"
  policy_arn = "${aws_iam_policy.policy.arn}"
}

地形输出：

aws_iam_role.lambdaRole: Creating...
aws_iam_role.lambdaRole: Creation complete after 2s [id=lambdaRole]
aws_iam_role_policy_attachment.attach-policies: Creating...
aws_iam_role_policy_attachment.attach-policies: Creation complete after 1s [id=lambdaRole-20191107141649610400000001]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

创建 IAM 角色并为其附加策略时出错

Error in creating IAM role and attach policies to it

terraform

terraform-provider-aws